EIP-2026-118918

This is a detailed writeup describing a vulnerability in ModSecurity Core Rules that allows bypassing SQL injection filters by exploiting differences in how duplicate HTTP parameters are handled by ModSecurity and ASP/ASP.NET applications. The technique involves splitting malicious payloads across multiple parameters to evade detection.